pubid 2.0.0.pre.alpha.2 → 2.0.0.pre.alpha.4

data/lib/pubid/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pubid
-  VERSION = "2.0.0.pre.alpha.2"
+  VERSION = "2.0.0.pre.alpha.4"
 end

data/lib/pubid.rb

@@ -1,10 +1,30 @@
 # frozen_string_literal: true
 
 require "lutaml/model"
-require_relative "pubid/lutaml/no_store_registration"
 require "parslet"
 
+# Eagerly load the Lutaml::Model patch (disables reference store to avoid
+# unbounded memory growth during bulk parsing, and adds a default +to_urn+
+# implementation to every Serializable). This must apply before any Pubid
+# code runs.
+require "pubid/lutaml/no_store_registration"
+
 module Pubid
+  # Upper bound on the length of an identifier string accepted by any +parse+
+  # entry point. Real-world standards identifiers are well under 200 characters;
+  # this limit exists purely to keep pathological, attacker-controlled inputs
+  # away from the flavors' backtracking-capable normalization regexes
+  # (CodeQL rb/polynomial-redos). The inline `.length` checks in every public
+  # +parse+ method are recognized by CodeQL as a barrier that bounds the input
+  # before it can reach those regexes. Ruby 3.2+ already memoizes the flagged
+  # regexes to linear time, so this guard is defense-in-depth, not a fix for a
+  # live exploit; it must therefore never reject a legitimate identifier.
+  MAX_INPUT_LENGTH = 1000
+
+  # Raised (as an ArgumentError) when an input string exceeds MAX_INPUT_LENGTH.
+  INPUT_TOO_LONG_MESSAGE =
+    "identifier string exceeds maximum length of #{MAX_INPUT_LENGTH} characters"
+
   # Registry for tracking all loaded flavors
   class Registry
     @flavors = {}
@@ -46,19 +66,19 @@ module Pubid
   autoload :BundledIdentifier, "pubid/bundled_identifier"
   autoload :Identifier, "pubid/identifier"
   autoload :IdentifierMetadata, "pubid/identifier_metadata"
-  autoload :IdentifierRegistry, "pubid/identifier_registry"
   autoload :Rendering, "pubid/rendering"
   autoload :Renderers, "pubid/renderers"
   autoload :FormatDetector, "pubid/format_detector"
   autoload :FormatRegistry, "pubid/format_registry"
-  autoload :Scheme, "pubid/scheme"
 
   autoload :UrnGenerator, "pubid/urn_generator/base"
+  autoload :UrnParser, "pubid/urn_parser"
   autoload :Builder, "pubid/builder/base"
   autoload :Utils, "pubid/utils"
   autoload :Version, "pubid/version"
   autoload :Core, "pubid/core"
 
+
   # Require all flavor modules
   autoload :Amca, "pubid/amca"
   autoload :Ansi, "pubid/ansi"
@@ -105,14 +125,15 @@ module Pubid
   # @param format [Symbol] :auto, :human, :mr_string, or :urn
   # @return [Identifier] The parsed identifier
   def self.parse(string, format: :auto)
+    raise ArgumentError, INPUT_TOO_LONG_MESSAGE if string.length > MAX_INPUT_LENGTH
+
     format = FormatDetector.detect(string) if format == :auto
 
     case format
     when :mr_string
       Parsers::MrString.parse(string)
     when :urn
-      # URN auto-detection: extract flavor from URN namespace
-      # e.g., "urn:iso:std:..." → Pubid::Iso
+      eager_load_flavors!
       flavor = detect_flavor_from_urn(string)
       flavor_module = Registry.get(flavor)
       unless flavor_module
@@ -121,8 +142,7 @@ module Pubid
       end
 
       urn_parser = flavor_module.const_get(:UrnParser)
-      urn_parser.parse(string)
-    else
+      urn_parser.parse(string) else
       # Default to MR string parser for MR format, human-readable otherwise
       # The MR string parser converts to human-readable and delegates to flavor.parse
       raise ArgumentError,
@@ -136,4 +156,22 @@ module Pubid
     parts = urn.downcase.split(":")
     parts[1] # The namespace part after "urn"
   end
+
+  # Trigger autoloads for every declared flavor module so that
+  # Registry is populated before URN dispatch needs it. Safe to call
+  # repeatedly; no-op after the first invocation.
+  def self.eager_load_flavors!
+    return if @flavors_loaded
+
+    constants.each do |c|
+      next unless c.to_s.match?(/\A[A-Z][a-zA-Z]+\z/)
+
+      begin
+        const_get(c)
+      rescue StandardError
+        nil
+      end
+    end
+    @flavors_loaded = true
+  end
 end

data/lib/tasks/export.rake

@@ -19,17 +19,18 @@ namespace :export do
   desc "Audit library data against website publishers"
   task :audit do
     require "pubid/export"
-    data = Pubid::Export::Exporter.export_all
 
-    # Parse website publishers to extract doc type keys
-    # For now, read the generated JSON and provide a summary
+    # Auditor compares string-keyed, JSON-shaped data (see Auditor.from_file and
+    # auditor_spec.rb), so roundtrip the export through JSON to convert the
+    # symbol keys (:identifier_types) into the string keys it expects.
+    data = JSON.parse(JSON.generate(Pubid::Export::Exporter.export_all))
     auditor = Pubid::Export::Auditor.new(data)
 
     # Build a minimal website representation from the generated data itself
     # (in production, this would parse the website's publishers.ts)
-    {}
     summary = data.transform_values do |fd|
-      { "doc_types" => fd[:identifier_types].map { |t| { "key" => t[:key] } } }
+      keys = fd["identifier_types"].map { |t| { "key" => t["key"] } }
+      { "doc_types" => keys }
     end
 
     results = auditor.audit(summary)